Meeting to mull privacy standard's next step

Computerworld - WASHINGTON -- The Platform for Privacy Preferences (P3P) was released in April, and so far about 18% of the top 500 Web sites are using it. But the rate of new adoptions of this privacy specification is glacial -- about 1% a month among top sites -- and financial services, the industry that handles some of the most sensitive personal information, has a much lower-than-average P3P adoption rate.
This week the people and companies behind the World Wide Web Consortium's (W3C) P3P standard will meet to talk about the future of the spec and whether a Version 2.0 is needed or whether some tweaking to Version 1.0 can address issues raised by industry groups.
One concern is that the spec's "vocabulary" isn't rich enough to allow exact translation of a written privacy policy into a machine-readable one.
Because of that problem, the Financial Services Roundtable's BITS technology group, a Washington-based industry association representing some of the largest financial services companies, wants the W3C "to state explicitly" that P3P statements "are not meant to be legally binding documents," according to a position paper prepared for this week's meeting at America Online Inc.'s facilities in Dulles, Va.
The legal uncertainty of P3P is a big issue, said Lorrie Cranor, a principal technical staff member at AT&T Labs-Research and chairman of the P3P Specification Working Group. But the W3C "can't give a definitive answer, because we don't write the laws."
Only 11% of top finance and investing Web sites have adopted P3P, vs. 18% overall for the top 500 sites, according to Ernst & Young LLP, which began reporting on P3P adoption in August.
At the current rate, it will take eight years or so for P3P to get fully adopted, said Brian Tretick, a principal at Ernst & Young. One reason for the sluggish rate of adoption is the economy, since some companies are interested in it but don't want to spend the money. Another is uncertainty about how P3P policies will be enforced.
At this week's meeting, the P3P working group may look at the idea of developing negotiation ability into P3P, said Cranor. As it stands, when a P3P-capable Web browser interacts with a Web site, the browser reacts based on the user's privacy preferences in a yes/no manner. Negotiation ability would allow a company to interact with the user and, for instance, offer a coupon in exchange for privacy information. This would also complicate things, requiring varying privacy policies to handle the results of any negotiations, she said.
Despitevarious issues to be hammered out, Tretick believes that as long as Internet Explorer and Netscape support P3P, the specification isn't going away and that firms will have to deal with it or risk losing some of their ability, for instance, to use persistent cookies with some customers.

Read more about Privacy in Computerworld's Privacy Topic Center.